CVE-2023-1974highCWE-1230

CVE-2023-1974: high-severity vulnerability in answerdev/answer

Exposure of Sensitive Information Through Metadata in answerdev/answer

Published · Updated

Follow this CVE+ Monitor answerdev/answer+ Monitor github.com/answerdev/answer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 0.6%
In short

The Answer application before version 1.0.8 leaks sensitive information through file metadata, allowing unauthorized users to discover details that should remain hidden. This can expose configuration data, internal paths, or other confidential information embedded in files.

Technical detail

CWE-1230 describes improper exposure of sensitive information through metadata in file systems or archives. In answer prior to 1.0.8, metadata attributes (timestamps, internal identifiers, or embedded comments) in served files may be accessible to unauthenticated attackers, leading to information disclosure without requiring special privileges or user interaction.

Summary generated and translated by AI from the official description.
Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8.
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
answerdev · answerdev/answer
Related CVEs — answerdev/answer

In the same product, most dangerous first.

CVE-2023-0744CRITICALImproper Access Control in answerdev/answerEPSS 6.4%CVE-2023-4125HIGHWeak Password Requirements in answerdev/answerEPSS 0.9%CVE-2023-0741HIGHCross-site Scripting (XSS) - DOM in answerdev/answerEPSS 0.9%CVE-2023-0742HIGHCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.9%CVE-2023-1537MEDIUMAuthentication Bypass by Capture-replay in answerdev/answerEPSS 0.8%CVE-2023-4815HIGHMissing Authentication for Critical Function in answerdev/answerEPSS 0.8%